Why the first week matters more than the rest
Blockchain records are permanent. Almost nothing else in a digital asset matter is. Websites are edited, support chats are closed, exchange interfaces change, hosting is moved, social accounts are deleted and archived copies are patchy. The material that decides whether a finding can be corroborated later is usually off-chain material, and off-chain material has a short life.
That asymmetry is the single most useful thing to understand at the start. There is no urgency about a transaction hash: it will read the same in five years. There is real urgency about the page that described the platform, the message that promised a withdrawal, or the certificate that identified the server. Capture that first, in the state it is in now, before anyone asks a question that prompts it to change.
What to capture, in order of fragility
Start with anything hosted by the other side. Full-page captures of every relevant web page, including terms, contact details, team pages and any dashboard you can still reach. Capture the whole page rather than a cropped screenshot of one figure, and record the exact address of the page and the date and time you took it.
Next, take your own account records. Export transaction histories, statements and confirmations from every platform involved while access lasts. Access is often lost precisely when a dispute becomes visible, and an export taken before that point is worth considerably more than a recollection taken afterwards.
Then correspondence, in full. Whole threads, not selected messages, including the parts that are unhelpful to you. A thread with gaps invites the reader to imagine what was removed; a complete thread does not. Where messages sit in an app that allows export, export rather than photograph.
Finally the durable identifiers: addresses, transaction hashes, domain names, invoice numbers, account references. These are small, they never change, and they are the anchors everything else is later attached to.
How to capture it so that it holds up
Three properties make captured material usable: it is complete, its origin is recorded, and it can be shown not to have changed since. Completeness means whole pages and whole threads. Origin means the source address, the capture time and the method used. Immutability, in practice, means computing a hash of each file when you capture it and keeping that list separately from the files themselves.
Hashing sounds technical and is not. A hash is a short fingerprint of a file; if a single byte of the file changes, the fingerprint changes too. Recording hashes at capture time is what later allows a reader to confirm that the file they are looking at is the file you took, rather than a version edited afterwards. This is the practical core of chain of custody, and it costs a few minutes.
Keep original files in their original formats. A PDF printed from a web page loses the underlying structure; a screenshot of a spreadsheet loses the values. Keep both if you like, but never discard the original in favour of a tidier copy.
What not to do
Do not contact the counterparty to test a theory. It rarely produces a usable admission and reliably prompts sites, accounts and infrastructure to disappear within hours.
Do not attempt to access anything that is not yours. Logging into someone else's account, guessing credentials or probing a system does not produce evidence that can be used; it produces a serious problem of its own and taints everything found alongside it. Every lawful investigation is bounded by publicly or lawfully accessible material, and there is more of that than most people expect.
Do not move remaining assets between your own wallets without recording why. Post-incident housekeeping transfers are frequently mistaken, later, for part of the incident itself, and untangling them consumes time that would be better spent elsewhere.
Do not edit or annotate captured files. Keep annotations in a separate document that refers to the file, so the original stays exactly as it was.
Writing your own account first
Before speaking to anyone, write a plain chronological account of what happened, with dates, and mark clearly which parts you observed directly and which parts you were told. Memory reorders events quickly once a matter becomes stressful, and an account written early is more accurate than one written a month later.
Keep it factual. An account that separates observation from inference is immediately more useful to an investigator, because it shows where the corroboration work needs to begin. Where you are unsure of a date, say so rather than estimating silently.
What this preparation cannot do
Good preparation improves what an investigation can establish. It does not determine the outcome, and it cannot create evidence that never existed. If the surrounding material was thin at the time, careful capture will document that it was thin rather than fill the gap.
Digital Asset Claims documents what the evidence supports. It does not hold, move or recover assets, does not execute transactions, does not administer funds and does not give legal or financial advice. The purpose of preparation is to make an evidential position clear, so that the people who can act on it are acting on something solid.